Privacy Policy

Sayso is provided by [DANK Studio legal entity], [address]. We are the data controller for account holders. For the answers people give to an Ask, the account holder who sent it is the controller and we process that data on their behalf.

We keep your email address, your name if you give one, and a hashed password. We keep the Asks you write and the links you create, including the label and email address you attach to each one. If you subscribe, Paddle keeps your payment details and we keep only their reference for your subscription and its status. If you send feedback from the dashboard, we keep the message together with the page you were on, your browser and window size, and a reference to any error that had just occurred.

You do not have an account and we do not ask you to make one. We keep the name and role you type in, every answer you give — typed text, links, and audio recordings — the transcripts and summaries we produce from the recordings, and which publication permissions you ticked. If you answer the optional “how was that?” at the end, we keep that too. Recordings are saved to your own device first and uploaded from there; a copy may remain in your browser’s storage until it is cleared.

Everything you give is visible to the person who sent you the Ask. It is their responsibility to tell you why they are collecting it and what they will do with it. Sayso asks you, separately, what they may publish, and shows them what you did not agree to.

The waitlist is closed, but we still hold what people gave it: an email address, a name, anything written about what they would use Sayso for, and which page they signed up from. We do not send a newsletter, and you can ask to be removed at any time.

We use a small number of services, each for one job, and each bound by its own data processing terms:

• Supabase — the database and the storage for recordings. Also handles sign-in.
• OpenAI — transcribes recordings and writes summaries. Audio and transcripts are sent to OpenAI for that purpose only; OpenAI does not train on data sent through its API.
• Paddle — takes payment, as merchant of record. Sees your email and payment details; we do not.
• Resend — sends the emails: invitations to answer an Ask, email confirmations, sign-in links, password resets, and notices to us.
• Sentry — records errors so we can fix them. Respondent links are stripped from reports before they are sent.
• Netlify — hosts the site.
• Microsoft Clarity — heatmaps and visit replays on our public pages and, with all text masked, in the dashboard. Without cookies. Also on open-for-all links, with everything masked. Never on the sign-in pages or a link made for one person.
• Umami — counts visits to the dashboard and the pages you are reading now. Never loaded on a respondent link, since that page’s address is itself the only thing standing between the public and someone’s answers.

We do not sell personal data, and we do not use recordings, transcripts or Asks to train models.

For as long as the account that collected it exists. When an account holder deletes their account, their Asks, links, answers and every recording are deleted with it. If you answered an Ask and want your answers removed sooner, ask the person who sent it, or write to us and we will help.

For account holders: performance of a contract. For people answering an Ask: the account holder’s lawful basis, which is usually the consent you give by choosing to answer — and, separately, the explicit permissions you tick or leave unticked for publication. For the closed waitlist: your consent when you signed up.

You can ask for a copy of what we hold about you, ask for it to be corrected or deleted, and object to or restrict how it is used. Account holders can do most of this from the settings page. For anything else, email us and we will respond within a month. If you are in the UK or EU you can also complain to your data protection authority.

One cookie, to keep you signed in, if you have an account. Nothing for advertising, and nothing that tracks you across other sites.

We use Umami to count visits — page views, referrer, browser, device type and country, nothing more. It sets no cookies and stores no IP address: visits are identified by a hash of your IP, browser and today’s date that changes every day and cannot be reversed, so nobody — including us — can tell one day’s visit from you apart from any other day’s, let alone identify you personally. It never runs on a respondent link, because that link’s own address is itself the credential answering it depends on.

On our public pages and in the dashboard we also use Microsoft Clarity to see where people get stuck: where they click and scroll, and a replay of the visit. It is set to run without cookies and without following you from one visit to the next. Text you type into a form on the public pages is masked, and inside the dashboard all text is masked, so the replay shows what was clicked but never what your Asks or the answers to them say. It never runs on the sign-in pages, and never on a link made for one person, since that link’s address is itself the only thing protecting their answers. It does run on an open-for-all link — one link shared with anyone — whose address identifies nobody. There, everything on the page is masked: it can see that someone clicked, scrolled or stalled, never their name, their words or their recording. Microsoft processes what it collects on our behalf.

If this policy changes in a way that affects you we will email account holders before it applies. Questions or requests: hello@dankstudio.net.